Privilege Escalation
iam:CreateLoginProfile
An attacker with iam:CreateLoginProfile sets a password on a programmatic-only user, then signs in to the console as that user.
Required Permissions
Description
iam:CreateLoginProfile attaches a console password to an IAM user that does not already have one. Programmatic-only users (no login profile) are common targets because the operation is a one-shot: it only succeeds on users with no existing password.
The hackaws agent picks the most privileged eligible user, calls CreateLoginProfile with a fresh password, and waits for propagation. It then signs in to the console as that user through a headless browser and uses the console session to mint a long-term access key, so the escalation survives beyond the password reset window.
The console path is important because the console session can create an access key that works outside the browser. The resulting access key is long-term credentials for the privileged user.
Impact
A console-login path and long-term CLI credentials for the target user. If the target has administrator access, the attacker holds admin credentials outside the current session.
Detection
Alert on CreateLoginProfile events where the UserName is a programmatic user. Alert on first-ever console sign-ins for users that have been key-only. Correlate CreateLoginProfile with CreateAccessKey calls from the same source IP shortly after.
Mitigation
Deny iam:CreateLoginProfile from non-admin principals through an SCP. Mark programmatic-only users with a tag and deny console sign-in for them with an identity-based policy. Require MFA on every console sign-in.